Brand impersonation phishing is when a criminal builds a fake email, website or message that closely mimics a trusted brand. In retail, the targets aren’t just customers. Staff are just as likely to receive a convincing lookalike email that appears to come from a supplier, a delivery partner or even their own employer.
What Brand Impersonation Attacks Look Like in Retail
Some of the most commonly spoofed names in UK retail phishing include Royal Mail, Evri, Amazon and DHL. According to a 2025 TransUnion survey, 40% of UK adults had received a scam message purporting to be from Royal Mail, with Evri close behind at 38%, making parcel delivery the most impersonated sector in the country. Amazon is the dominant spoofed brand when it comes to online retail, while DHL is consistently cited as one of the most impersonated logistics companies worldwide.
A typical attack might involve an email that looks like a Royal Mail parcel notification, prompting the recipient to pay a small redelivery fee. The email uses the correct fonts and colours, and the link goes to a near-identical fake site. For staff, it could look like an internal IT alert, a fake invoice from a known supplier, or a spoofed email from a senior colleague.
The domain name is often where the deception happens. Something like “royalmail-delivery.co” or “royalmail-parcels.net” can pass a quick glance. Attackers also use lookalike characters in email addresses, swapping letters like “rn” for “m” or using subdomains to make the sender appear legitimate.
Why Staff Are a Primary Target
Customers are an obvious target, but employees often present a bigger opportunity. A member of the finance team who clicks a spoofed supplier invoice, or a store manager who enters credentials into a fake Microsoft 365 login, can hand attackers access to internal systems.
This is why more UK retailers are turning to staff awareness programmes to close the gap. One way to measure actual vulnerability is to run a realistic phishing simulation service, which sends controlled fake emails to employees and tracks who clicks, who reports, and who submits credentials. The results often surprise organisations that assumed their teams were already prepared.
These tests don’t just reveal weakness. They create a concrete starting point for targeted training, so the response is based on real data rather than assumptions.
What Makes Retail Brands Such Effective Bait
Retail brands work well as phishing lures for a few reasons:
- High email volume: Customers and staff expect lots of transactional emails from retailers, so one more doesn’t raise immediate suspicion.
- Urgency triggers: Messages about failed deliveries, account suspensions or payment problems create pressure to act fast.
- Seasonal spikes: Attack volumes rise sharply around Black Friday, Christmas and major sale periods, when staff are busier and less likely to pause and check. Research from Darktrace recorded a 620% surge in phishing attacks targeting shoppers in the weeks leading into Black Friday 2025, with volumes expected to climb a further 20 to 30% during the sale weekend itself.
Attackers time their campaigns carefully. A fake Amazon or Royal Mail message sent during a peak period is far more likely to get a click than the same message sent in January.
The Verdict
Brand impersonation works because it exploits familiarity and time pressure. Recognising the signs helps, but awareness has to be actively maintained. Staff who were well-trained twelve months ago may still fall for a well-crafted fake today, particularly when the attack uses a brand they deal with daily.
The most effective defence combines regular training with controlled testing. Without knowing how your team actually responds, it’s difficult to know where the gaps are.